Calif. Gov Terminates RFID ID Bill

By Mary Catherine O'Connor

Oct. 2, 2006—On Saturday, California Governor Arnold Schwarzenegger vetoed SB 768, the Identity Information Protection Act of 2006, which would have been the first state bill to address how RFID technology may be used in identification documents issued by state and local governments and agencies.

Before passing through both houses earlier this year, the bill, written by California State Senator Joe Simitian (D), had gone through a couple of significant amendments. These included a downgrade from a moratorium on the use of the technology to a set of interim, security-based conditions users would need to meet. It was then sent to the governor's office on Sept. 7 after the California Senate approved it in a 30-to-7 vote.

Governor Arnold Schwarzenegger

In a statement, the governor called the bill premature, saying it could make it more difficult for law-enforcement officers to "impose requirements in California that would contradict the federal mandates soon to be issued," referring to the Real ID Act, which President Bush passed last year to establish a federally approved ID card that would be electronically readable. RFID technology may be used in these cards, though a decision to do so has yet to be made. The governor's concerns echo those related in letters presented to him within the past six weeks from a number of California law-enforcement agencies. These letters also claim the law-enforcement agencies were not "seriously consulted" about the bill.

"We had reached out to law enforcement over a year ago," Simitian says, "so I think law-enforcement's reaction [to the bill's passage through the legislature] was unfortunate and inaccurate." He added that the bill had been part of a "vigorous, two-year debate," and that people concerned with the bill could have expressed their concern during that time.

As for how the Real ID Act would have impacted SB 768 had the governor signed it into law, Simitian said California would most likely be obliged to follow the Federal government's lead on a national ID card. The bill, however, would still have provided regulations on how RFID would be used in state-issued IDs not impacted by Real ID Act regulations.

The security rules had a sunset date of Dec, 31, 2012, and were designed to be put in place while the California Research Bureau (CRB) would have conducted a research study into the use of RFID in government-issued "remotely readable identification documents," as well as the security and privacy implications of the technology's use. The CRB would have also called for an advisory board composed of government officials and representatives from industry and privacy-rights organizations. This board would have advised it on the technology and its application in identity documents—everything from driver's licenses to library cards.

The security rules called for the incorporation of tamper-resistant authentication tools to prevent duplication, forgery or cloning of the ID. Mutual authentication between the interrogator and tag embedded in the ID would have been required if any personally identifiable information—such as an individual's picture, Social Security number or name—were transmitted between the tag and reader. The IDs would have also needed to employ encryption or some other method of making such information unreadable or unusable by an unauthorized person, as well as offer an on/off switch or similar means of giving the ID holder direct control over any data transmission.